Canada ITSG-33 - IT Security Risk Management A2-6: 6 Specify and verify security requirements for external capabilities and mandated IT services

What does A2-6 require?

When a project uses a capability from another organisation, department or commercial provider, it adds an activity to specify the security requirements the capability and provider must meet (functional security, the provider's own security such as incident management, and trust in its delivery), from the assurance requirements, business needs, system controls, policy needs and design, and uses them in the procurement (memorandum of understanding, service level agreement or request for proposal), which must assess compliance. An ISO 27001 certificate alone does not prove fitness. For mandated services such as those of Shared Services Canada, the department compares the provider's risk process, threat assessment, profiles and reporting with its own to judge whether the service's posture is adequate.